CVE-2025-4597 - Woo Slider Pro - Drag Drop Slider Builder For WooCommerce <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

Back Back to CVE browser

MEDIUM

Woo Slider Pro - Drag Drop Slider Builder For WooCommerce <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

Published May 30, 2025

6.5

MEDIUM

CVSS 3.1

EPSS 0.26%

Description

The Woo Slider Pro – Drag Drop Slider Builder For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woo_slide_pro_delete_draft_preview AJAX action in all versions up to, and including, 1.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.

Affected products

Vendor n/a Product Woo Slider Pro – Drag Drop Slider Builder For WooCommerce Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.12

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Woo Slider Pro – Drag Drop Slider Builder For WooCommerce

unaffected

Version	Status	Constraints
0	affected	<=1.12

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

Link	Providers	Tags
https://plugins.trac.wordpress.org/browser/woo-slider-pro-drag-drop-slider-builder-for-woocommerce/trunk/inc/actions.php#L111
https://www.wordfence.com/threat-intel/vulnerabilities/id/1eaee0f6-968c-4004-83e7-f79baf3ff88d?source=cve